Detects suspicious user agent string of APT40 Dropbox tool

Detects Rclone config files being created

Detects execution of RClone utility for exfiltration as used by various ransomwares strains like REvil, Conti, FiveHands, etc

Detects DNS queries for anonfiles.com, which is an anonymous file upload platform often used for malicious purposes

Detects DNS queries for "anonfiles.com", which is an anonymous file upload platform often used for malicious purposes

Detects DNS queries for subdomains used for upload to MEGA.io

Detects DNS queries to "ufile.io". Which is often abused by malware for upload and exfiltration

Detects the use of rclone, a command-line program to manage files on cloud storage, via its default user-agent string

Detects DNS queries for subdomains used for upload to MEGA.io

Detects DNS queries to "ufile.io". Which is often abused by malware for upload and exfiltration

Detects DNS queries for subdomains used for upload to ufile.io